Description

In JetBrains Ktor before 3.6.1 session forgery was possible via tampered encrypted session cookies

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-11-06T11:17:11.170Z",
  "pubdate": "2026-11-06T11:17:11.170Z",
  "executiveSummary": "A session forgery vulnerability exists in JetBrains Ktor prior to version 3.6.1 due to improper handling of encrypted session cookies.\nThe vulnerability allows an unauthenticated attacker to manipulate the contents of an encrypted session cookie, potentially resulting in unauthorized account access or privilege escalation.\nThe issue lies within the session authentication and integrity verification mechanisms, which fail to adequately prevent tampering when specific encryption configurations are utilized.\nThis flaw impacts applications utilizing Ktor's session management features, exposing the application state to external manipulation.\nSuccessful exploitation requires the attacker to have the ability to intercept or modify the session cookie presented to the server.\nRisk implications include full session hijacking, bypass of authentication controls, and the ability to impersonate legitimate users within the affected Ktor-based ecosystem.\nUsers are advised to upgrade to version 3.6.1 or later to implement the necessary security fixes regarding session integrity and cryptographic enforcement.",
  "technicalDetails": "The vulnerability originates from a failure in the integrity verification process for encrypted session cookies within the Ktor framework. In versions prior to 3.6.1, the session serialization and encryption process did not sufficiently enforce the binding between the encrypted payload and its integrity tag or signature, or failed to prevent malleability during the decryption phase.\nWhen Ktor processes an incoming session cookie, it decrypts the content to retrieve session data. If the encryption implementation is susceptible to tampering—or if the server-side logic fails to validate the ciphertext's authenticity before processing the underlying serialized session object—an attacker can modify specific bits within the encrypted cookie string.\nThe attack flow begins with the attacker obtaining a legitimate encrypted session cookie, for instance, via network interception or by observing their own session interactions. Using techniques such as bit-flipping attacks on the ciphertext (if the encryption mode is malleable, such as CBC without a proper HMAC, or if an authenticated encryption mode is improperly implemented), the attacker injects chosen values into the session object.\nOnce the tampered cookie is transmitted to the server, the Ktor session middleware attempts to decrypt it. Because the integrity check is either bypassed or absent, the modified payload is successfully decrypted into a manipulated session state.\nThe application subsequently deserializes this malicious session object. If the session object contains critical user identity fields (e.g., 'user_id', 'is_admin', or 'authenticated'), these fields can be overwritten by the attacker's payload. The application then trusts this forged identity, granting the attacker the privileges associated with the manipulated user state.\nThis vulnerability is particularly critical for applications that store user identifiers directly within the encrypted session cookie rather than relying on server-side session storage lookups. The lack of strict authenticated encryption or a post-decryption integrity verification step allows the transition from a legitimate user session to an unauthorized state without knowledge of the encryption keys.\nThe exposure is network-wide, as session cookies are typically transmitted in HTTP headers. Any environment where Ktor session management is active and relies solely on client-side encrypted cookies is considered vulnerable. Post-exploitation, the attacker gains full control over the session identity, effectively bypassing standard authentication flows and potentially accessing sensitive data or administrative functions within the application context."
}